com.google.auth.oauth2

Class ServiceAccountJwtAccessCredentials

java.lang.Object

com.google.auth.Credentials

com.google.auth.oauth2.ServiceAccountJwtAccessCredentials

All Implemented Interfaces:

JwtProvider, QuotaProjectIdProvider, ServiceAccountSigner, Serializable

public class ServiceAccountJwtAccessCredentials
extends Credentials
implements JwtProvider, ServiceAccountSigner, QuotaProjectIdProvider

Service Account credentials for calling Google APIs using a JWT directly for access.

Uses a JSON Web Token (JWT) directly in the request metadata to provide authorization.

See Also:

Serialized Form

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	ServiceAccountJwtAccessCredentials.Builder

Nested classes/interfaces inherited from interface com.google.auth.ServiceAccountSigner

ServiceAccountSigner.SigningException

Method Summary

Modifier and Type	Method and Description
boolean	equals(Object obj)
static ServiceAccountJwtAccessCredentials	fromPkcs8(String clientId, String clientEmail, String privateKeyPkcs8, String privateKeyId) Factory using PKCS#8 for the private key.
static ServiceAccountJwtAccessCredentials	fromPkcs8(String clientId, String clientEmail, String privateKeyPkcs8, String privateKeyId, URI defaultAudience) Factory using PKCS#8 for the private key.
static ServiceAccountJwtAccessCredentials	fromStream(InputStream credentialsStream) Returns credentials defined by a Service Account key file in JSON format from the Google Developers Console.
static ServiceAccountJwtAccessCredentials	fromStream(InputStream credentialsStream, URI defaultAudience) Returns credentials defined by a Service Account key file in JSON format from the Google Developers Console.
String	getAccount() Returns the service account associated with the signer.
String	getAuthenticationType() A constant string name describing the authentication technology.
String	getClientEmail()
String	getClientId()
PrivateKey	getPrivateKey()
String	getPrivateKeyId()
String	getQuotaProjectId()
Map<String,List<String>>	getRequestMetadata(URI uri) Provide the request metadata by putting an access JWT directly in the metadata.
void	getRequestMetadata(URI uri, Executor executor, RequestMetadataCallback callback) Get the current request metadata without blocking.
int	hashCode()
boolean	hasRequestMetadata() Whether the credentials have metadata entries that should be added to each request.
boolean	hasRequestMetadataOnly() Indicates whether or not the Auth mechanism works purely by including request metadata.
JwtCredentials	jwtWithClaims(JwtClaims newClaims) Returns a new JwtCredentials instance with modified claims.
static ServiceAccountJwtAccessCredentials.Builder	newBuilder()
void	refresh() Discard any cached data
byte[]	sign(byte[] toSign) Signs the provided bytes using the private key associated with the service account.
ServiceAccountJwtAccessCredentials.Builder	toBuilder()
String	toString()

Methods inherited from class com.google.auth.Credentials

blockingGetToCallback, getRequestMetadata

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Method Detail

fromPkcs8

public static ServiceAccountJwtAccessCredentials fromPkcs8(String clientId,
                                                           String clientEmail,
                                                           String privateKeyPkcs8,
                                                           String privateKeyId)
                                                    throws IOException

Factory using PKCS#8 for the private key.

Parameters:

clientId - Client ID of the service account from the console. May be null.

clientEmail - Client email address of the service account from the console.

privateKeyPkcs8 - RSA private key object for the service account in PKCS#8 format.

privateKeyId - Private key identifier for the service account. May be null.

Returns:

New ServiceAccountJwtAcceessCredentials created from a private key.

Throws:

IOException - if the credential cannot be created from the private key.

fromPkcs8

public static ServiceAccountJwtAccessCredentials fromPkcs8(String clientId,
                                                           String clientEmail,
                                                           String privateKeyPkcs8,
                                                           String privateKeyId,
                                                           URI defaultAudience)
                                                    throws IOException

Factory using PKCS#8 for the private key.

Parameters:

clientId - Client ID of the service account from the console. May be null.

clientEmail - Client email address of the service account from the console.

privateKeyPkcs8 - RSA private key object for the service account in PKCS#8 format.

privateKeyId - Private key identifier for the service account. May be null.

defaultAudience - Audience to use if not provided by transport. May be null.

Returns:

New ServiceAccountJwtAcceessCredentials created from a private key.

Throws:

IOException - if the credential cannot be created from the private key.

fromStream

public static ServiceAccountJwtAccessCredentials fromStream(InputStream credentialsStream)
                                                     throws IOException

Returns credentials defined by a Service Account key file in JSON format from the Google Developers Console.

Parameters:

credentialsStream - the stream with the credential definition.

Returns:

the credential defined by the credentialsStream.

Throws:

IOException - if the credential cannot be created from the stream.

fromStream

public static ServiceAccountJwtAccessCredentials fromStream(InputStream credentialsStream,
                                                            URI defaultAudience)
                                                     throws IOException

Returns credentials defined by a Service Account key file in JSON format from the Google Developers Console.

Parameters:

credentialsStream - the stream with the credential definition.

defaultAudience - Audience to use if not provided by transport. May be null.

Returns:

the credential defined by the credentialsStream.

Throws:

IOException - if the credential cannot be created from the stream.

jwtWithClaims

public JwtCredentials jwtWithClaims(JwtClaims newClaims)

Returns a new JwtCredentials instance with modified claims.

Specified by:

jwtWithClaims in interface JwtProvider

Parameters:

newClaims - new claims. Any unspecified claim fields will default to the the current values.

Returns:

new credentials

getAuthenticationType

public String getAuthenticationType()

Description copied from class: Credentials

A constant string name describing the authentication technology.

E.g. “OAuth2”, “SSL”. For use by the transport layer to determine whether it supports the type of authentication in the case where Credentials.hasRequestMetadataOnly() is false. Also serves as a debugging helper.

Specified by:

getAuthenticationType in class Credentials

Returns:

The type of authentication used.

hasRequestMetadata

public boolean hasRequestMetadata()

Description copied from class: Credentials

Whether the credentials have metadata entries that should be added to each request.

This should be called by the transport layer to see if Credentials.getRequestMetadata() should be used for each request.

Specified by:

hasRequestMetadata in class Credentials

Returns:

Whether or not the transport layer should call Credentials.getRequestMetadata()

hasRequestMetadataOnly

public boolean hasRequestMetadataOnly()

Description copied from class: Credentials

Indicates whether or not the Auth mechanism works purely by including request metadata.

This is meant for the transport layer. If this is true a transport does not need to take actions other than including the request metadata. If this is false, a transport must specifically know about the authentication technology to support it, and should fail to accept the credentials otherwise.

Specified by:

hasRequestMetadataOnly in class Credentials

Returns:

Whether or not the Auth mechanism works purely by including request metadata.

getRequestMetadata

public void getRequestMetadata(URI uri,
                               Executor executor,
                               RequestMetadataCallback callback)

Description copied from class: Credentials

Get the current request metadata without blocking.

This should be called by the transport layer on each request, and the data should be populated in headers or other context. The implementation can either call the callback inline or asynchronously. Either way it should never block in this method. The executor is provided for tasks that may block.

The default implementation will just call Credentials.getRequestMetadata(URI) then the callback from the given executor.

The convention for handling binary data is for the key in the returned map to end with "-bin" and for the corresponding values to be base64 encoded.

Overrides:

getRequestMetadata in class Credentials

Parameters:

uri - URI of the entry point for the request.

executor - Executor to perform the request.

callback - Callback to execute when the request is finished.

getRequestMetadata

public Map<String,List<String>> getRequestMetadata(URI uri)
                                            throws IOException

Provide the request metadata by putting an access JWT directly in the metadata.

Specified by:

getRequestMetadata in class Credentials

Parameters:

uri - URI of the entry point for the request.

Returns:

The request metadata used for populating headers or other context.

Throws:

IOException - if there was an error getting up-to-date access. The exception should implement Retryable and isRetryable() will return true if the operation may be retried.

refresh

public void refresh()

Discard any cached data

Specified by:

refresh in class Credentials

getClientId

public final String getClientId()

getClientEmail

public final String getClientEmail()

getPrivateKey

public final PrivateKey getPrivateKey()

getPrivateKeyId

public final String getPrivateKeyId()

getAccount

public String getAccount()

Description copied from interface: ServiceAccountSigner

Returns the service account associated with the signer.

Specified by:

getAccount in interface ServiceAccountSigner

Returns:

The service account associated with the signer.

sign

public byte[] sign(byte[] toSign)

Description copied from interface: ServiceAccountSigner

Signs the provided bytes using the private key associated with the service account.

Specified by:

sign in interface ServiceAccountSigner

Parameters:

toSign - bytes to sign

Returns:

signed bytes

hashCode

public int hashCode()

Overrides:

hashCode in class Object

toString

public String toString()

Overrides:

toString in class Object

equals

public boolean equals(Object obj)

Overrides:

equals in class Object

newBuilder

public static ServiceAccountJwtAccessCredentials.Builder newBuilder()

toBuilder

public ServiceAccountJwtAccessCredentials.Builder toBuilder()

getQuotaProjectId

public String getQuotaProjectId()

Specified by:

getQuotaProjectId in interface QuotaProjectIdProvider

Returns:

the quota project ID used for quota and billing purposes